- Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Bump the release number and rebuild with the correct JIRA Resolves: RHEL-70587 - Bump release for RHEL-10 Resolves: RHEL-40030 - add rpminspect.yaml to turn of debuginfo check - add compile options for passing annocheck - Add an rpminspect.yaml file to turn-off debuginfo testing Resolves: RHEL-70580 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - change gating.yaml target from rhel-9 to rhel-10 Resolves: RHEL-40030 - Add gating.yaml - Add tests dir Resolves: RHEL-30448 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Makefile cleanups and added .gitignore - remove Red Hat Makefile targets and specfile - ensure all files have valid SPDX license identifiers - version bump - Remove rteval -s as a gating test Resolves: RHEL-131402 - Update to rteval-3.10 - set rtla timerlat dma latency to 0 to be more consistent with cyclictest - Create a commandline switch for rteval to use cyclictest - Update rteval-loads requirement to >= 6.17.7-1 Resolves: RHEL-82915, RHEL-116596, RHEL-114927 - Convert spec file to use pyproject.toml build system - Add 8 patches from upstream (spelling fixes, typo corrections, cleanups) - Modernize packaging with %pyproject_wheel and %pyproject_install macros Resolves: RHEL-114900 - Make timerlat the default measurement module - Make the default interval 100us Resolves: RHEL-97541 - rteval: services.py: Fix SyntaxWarning Resolves: RHEL-92783 - Make the default interval for timerlat in rteval 1100us - Make cyclictest the default measurement module for rteval Resolves: RHEL-78395 - Fix missing system statistics Resolves: RHEL-70167 - Rebase to upstream rteval-3.9 Resolves: RHEL-65483 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add patch to put stress-ng options in their own manpage section - Change constant name earlystop TO EARLYSTOP - Update the kcompile kernel to linux-6.12-rc4 Resolves: RHEL-63611 - Fix run_tests.sh to test linux-6.17.7.tar.xz is installed as a compile load Resolves: RHEL-131349 - Rebuild in a side-tag to sync with rteval Resolves: RHEL-86702 - Changed the kernel version to 6.17.7 - changed the rteval-loads number scheme to reflect the kernel version Resolves: RHEL-86702 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to linux-6.12-rc4 which contains the patches to remove dependency on deprecated <openssl/engine.h> Resolves: RHEL-63613 - Create a kernel based off of linux-6.10.5 and three upstream patches to remove a dependency on deprecated <openssl/engine.h> Resolves: RHEL-47107 - Remove code using deprectated engine.h until a better solution available Resolves: RHEL-47107 - Bump release for June 2024 mass rebuild - Change the gating.yaml from rhel-9 to rhel-10 Resolves: RHEL-42982 - Add gating.yaml - Add tests Resolves: RHEL-30432 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66636 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66613 - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181667 - new release - rebased tuned to latest upstream related: RHEL-123608 - new release - rebased tuned to latest upstream resolves: RHEL-123608 - cpu-partitioning: autodetect dracut hook directory, systemd workaround resolves: RHEL-40619 - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states resolves: RHEL-142285 - man: fixed instance_acquire_devices example in tuned-adm man resolves: RHEL-90575 - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - cpu-partitioning: added initrd generation dracut/systemd workarounds resolves: RHEL-120175 - new release - rebased tuned to latest upstream related: RHEL-94809 - new release - rebased tuned to latest upstream resolves: RHEL-94809 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance resolves: RHEL-94842 - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option resolves: RHEL-88238 - functions: silenced errors if module kvm_intel does not exist - functions: make calc_isolated_cores return CPU ranges - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports resolves: RHEL-79913 - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: disable appropriate P-State drivers - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher resolves: RHEL-97087 - udev-settle: obey udev buffer size and handle possible tracebacks resolves: RHEL-92637 - daemon: re-raise daemon init exception in no-daemon mode - vm: deprecate dirty_ratio in favour of dirty_bytes with percents - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-94185 - new release - rebased tuned to latest upstream related: RHEL-70454 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion - new release - rebased tuned to latest upstream related: RHEL-70454 - sap-hana: Set transparent_hugepages to madvise resolves: RHEL-68454 - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback resolves: RHEL-74384 - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed resolves: RHEL-69933 - plugin_scheduler: postpone cgroup blacklist check, double-check after fail - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support